Mailspring Read Receipts: Does Mailspring Track Your Email?

Mailspring read receipts are not hidden in a settings menu. They sit in the composer as an eye icon, and on a fresh install the eye starts switched on. Mailspring is a free desktop client for Mac, Windows and Linux from Foundry 376, and because its interface is open source, the Mailspring email tracking question has an unusually exact answer: we can read the code that builds the pixel. If someone writes to you from Mailspring, a tiny image with your address encoded inside it may well have come along. Here is what it reports, where it goes, and how to stop it.

Key Takeaways

• Mailspring's composer toggle treats open and link tracking as on unless the sender has turned them off, and founder Ben Gotow wrote in 2021 that hiding them would "risk lowering the Pro conversion rate."
• Mailspring 1.18.0, released February 23, 2026, moved its pixel to link.getmailspring.com/o/<token>.png and dropped the class name, zero size and "Sent from Mailspring" alt text that blockers looked for.
• The token is plain Base64, not encryption, and it carries the message ID, the sender's account ID and the recipient's email address.
• Senders see an open count plus each recipient's name and open time, and Mailspring 1.25.0 added an Engagement board that sorts recipients into "Highly engaged," "Engaged" and "Not engaged."
• Mailspring loads remote images by default for mail you receive, and its built in pixel list of 25 patterns only strips trackers from messages you sent yourself.

Does Mailspring Have Read Receipts?

Yes, Mailspring has pixel based read receipts and link tracking, sold as part of Mailspring Pro with a small free allowance. The Mailspring Pro page prices Pro at $8 per month and pitches it plainly: "Know the moment your email is read — and how many times it's been opened." Link tracking "shows which links your recipient clicked."

Free users get a taste. When the allowance runs out, the app's upgrade prompt says "You can get open and click notifications for %1$@ emails each %2$@ with Mailspring Basic," with the number and period filled in by Mailspring's server. How-To Geek, in a September 22, 2025 review, counted "five uses (could change in the future) for link tracking and pixel tracking per week."

Both plugins declare "isIdentityRequired": true in their package.json files, so tracking needs a Mailspring ID, the free account the setup wizard asks you to create. The wizard lets you skip it. The Pro page's "See How" links still point to a Zendesk help center that now shows "Oops, this help center no longer exists," so the source code is the best documentation left.

Is Mailspring Email Tracking On by Default?

Yes. In metadata-composer-toggle-button.tsx, the component behind both tracking buttons, the default check reads AppEnv.config.get(this._configKey()) !== false. A setting that was never touched is undefined, not false, so every new draft gets tracking switched on as long as the free allowance or a Pro plan covers it.

The choice is sticky. Clicking the eye writes the new state to plugins.open-tracking.defaultOn, so a sender who turns it off once keeps it off. A sender who never notices the icon tracks everyone.

This is deliberate. A user who found tracking "enabled by default on my fresh install" asked for it to be opt in back in October 2017, and the request drew 22 upvotes. Gotow's reply, reposted on Mailspring's community forum in January 2021, explained that these features are "the reason a lot of sales and business-oriented folks download and use Mailspring in the first place (and then pay for Mailspring Pro!)" He added: "I can't afford to obscure them by default and risk lowering the Pro conversion rate." Nine years after the request, the default hasn't changed.

How Does the Mailspring Tracking Pixel Work?

Mailspring writes a separate copy of the message for each recipient and adds an image tag pointing at its own server. The code lives in open-tracking-composer-extension.ts:

• Per recipient bodies: needsPerRecipientBodies returns true whenever tracking is on, so each person on To, Cc or Bcc gets a unique pixel.
• The token: a JSON object holding messageId, accountId and recipient, your email address, run through Base64url.
• The tag: <img alt="" src="https://link.getmailspring.com/o/<token>.png">, inserted just above any quoted earlier message.

Base64 is an encoding anyone can reverse. Open Show original on a tracked message in Gmail, copy the string between /o/ and .png, decode it, and your own address appears in plain text.

Link tracking, in the link-tracking plugin, rewrites every link into link.getmailspring.com/link/<message-id>/<n>?redirect=<original URL>&recipient=<Base64 email>.

The February 2026 Change

Until early 2026 the pixel was easy to catch. It looked like <img class="mailspring-open" alt="Sent from Mailspring" width="0" height="0">, loaded from a /open/ path with ?me= and &recipient= in the query. Pull request #2613, merged February 18, 2026, removed all of that. Its commit message is blunt: these "are the primary heuristics that email-client tracking-pixel blockers use for detection," and the new /o/ format "makes the URL indistinguishable from a regular image request and removes the identifiable query parameters that blocker extensions scan for."

The 1.18.0 release notes of February 23, 2026 describe the same change as "Improved read receipt tracking pixel reliability." Reliability, here, means getting past the reader's blocker. Our Mimestream investigation found that Mimestream 1.10.8 blocks Mailspring with the pattern getmailspring\.com/open. That string does not appear in the new URL, so any list written before February needs a new rule.

What Did We Find on link.getmailspring.com?

We found a live tracking server on Fly.io that answers any pixel request with an invisible image. The package.json files for open-tracking and link-tracking both name https://link.getmailspring.com as the production server. Our checks on October 6, 2026:

• DNS: link.getmailspring.com resolves to 137.66.50.154, which whois assigns to Fly.io, the same address as id.getmailspring.com. A nonsense subdomain returned NXDOMAIN, so the zone has no wildcard.
• New pixel path: /o/ with a made up token returned HTTP 200, image/png, 67 bytes, a 1 by 1 PNG, with a no-store, no-cache header telling caches not to keep it. A garbage token got the identical response.
• Old pixel path: /open/ with a fake ID still returned the same 67 byte PNG, so mail sent before 1.18.0 keeps reporting.
• Control: a nonsense path returned 404 with a JSON error, so the 200s are not a catch all.
• Click path: /link/ with a message ID we invented and a redirect to example.com answered 302 to example.com. The server follows the redirect parameter whether or not the message exists.

What Does a Mailspring Sender See?

A Mailspring sender sees how many times a message was opened, which recipient opened it and at what time, but no location. The message status component shows a count such as "3 opens" and an "Opened by" list pairing each recipient's name with a time. None of the client code we read displays an IP address, city or device.

Mailspring 1.25.0, released September 19, 2026, went further. Its Activity panel gained a Feed tab with CSV export, whose columns include Recipient Email, Event and Link, and an Engagement tab that "ranks your recipients by how much they open and click your mail." The tiers in engagement-tiers.ts are explicit: "Highly engaged" means you "Replied, clicked a link, or opened a tracked message three or more times." A code comment says the rules mirror "Mixmax's published rules," a sales engagement tool. A free desktop client now scores its users' contacts the way sales teams score leads.

The numbers are noisy, and Gotow says so. In a September 18, 2026 forum reply, he wrote that "Apple Mail's privacy protection and Gmail's image proxy both load images in the background, sometimes before anyone reads the message," and that opening a reply which quotes a tracked message counts as an open of the original.

Mailspring's privacy policy, last updated March 8, 2019, says linked email addresses go "to our servers and associated with your Mailspring ID to enable application features such as read receipts." It promises that sync happens locally and that Mailspring does not move "metadata derived from your mail data off of your computer" unless you enable thread sharing. Tracking doesn't fit neatly inside that promise: every pixel hit lands on Mailspring's server, and the open log of recipient and time reaches the sender's app as message metadata tied to the Mailspring ID. The policy has no section on read receipts and no retention period for open data.

Does Mailspring Block Trackers in Mail You Receive?

Not by default. In config-schema.ts, "Automatically load images in viewed messages" has default: true. The image plugin holds back remote content only in the Spam folder or when you turn that setting off, and then offers "Show Images" or "Always show images from" a sender.

Mailspring does carry a tracker list, but it rarely helps readers. The remove-tracking-pixels plugin lists 25 URL patterns for tools like Yesware, Streak, Mailtrack and HubSpot, last extended in April 2020, and the code applies them only when message.isFromMe() is true, meaning mail you sent. For everyone else's mail it strips only Mailspring's own pixels for your account. A 2019 request to "block email tracking attempts while displaying standard images" sits on the forum, tagged accepted and help wanted.

If you do turn images off, recent releases tightened the seal. Version 1.21.0 "Improved email sanitization to block CSS @import tracking vectors," and the 1.26.0 notes from October 2026 say replying, forwarding and sending "no longer fetch remote images referenced by the message when automatic image loading is off." Before that fix, hitting Reply could fire a pixel you had blocked.

Mailspring vs Airmail, Mailbird, Polymail and Mimestream

Mailspring stands out in this group for tracking on by default and for publicly re engineering its pixel to beat blockers. The other rows come from our Airmail read receipts investigation, our Mailbird email tracking investigation, our Polymail tracking investigation and the Mimestream piece above.

What This Means for Your Gmail Inbox

If you read Gmail on the web, Google's proxy fetches the pixel for you, so Mailspring's server sees a Google address rather than yours. Gmail's image help page promises "Senders can't use image loading to get information about your computer or location," then concedes "Sometimes, senders may know whether you've opened an email that has an image." Mailspring's 1 by 1 PNG is exactly that case: the sender learns that you opened it and when. We break down what slips through in the tracking pixel that learned to dodge Gmail.

The pixel also outlives the first message. Because it sits above the quoted text, every reply that quotes it carries it along, and Gotow confirms those reloads get "attributed to the original message." Forward a tracked email to a colleague and their opens can land on your name in the sender's Engagement board. Gmail's proxy hides where you are. It does not hide whether you are engaged.

How Do You Block Mailspring Email Tracking?

If you receive mail from Mailspring users, block images from link.getmailspring.com and check links before you click. In Gmail:

1. Ask before showing images. Per Google's help page, open Settings, See all settings, then select "Ask before displaying external images" under Images and save. This stops every pixel, along with every legitimate image.
2. Block the host itself. A rule matching link.getmailspring.com catches both the old /open/ pixels and the new /o/ ones without hiding other images. Gblock's custom filters accept a plain string like that.
3. Hover before clicking. A link starting with link.getmailspring.com/link/ will log your click. The real address follows redirect=; decode it and visit that directly.
4. Trim quoted text when you forward. Deleting the quoted original removes the pixel from the copy you pass on.

Browser extensions for Gmail, checked October 6, 2026:

• Trocker (10,000 users, version 3.4.1, updated July 10, 2026) blocks known trackers across webmail.
• PixelBlock (40,000 users, updated December 2, 2025) blocks open tracking in Gmail.
• Ugly Email is no longer in the Chrome Web Store; its Firefox add on shows 2,047 average daily users and a last update on March 6, 2024.
• Gblock runs in Gmail on desktop Chrome. It blocks known spy pixel hosts from a self updating list, flags unknown images of 150 bytes or less (Mailspring's is 67), routes clicks through its own link proxy and lets you add custom block rules.

We did not test whether Trocker or PixelBlock already match the /o/ format, so a custom rule is the safest bet with any of them. More options in how to block email tracking in Gmail and our roundup of email tracker Chrome extensions.

If You Use Mailspring Yourself

1. Click the eye and link icons off once in the composer. The code saves that as your default for every later draft.
2. Turn off "Automatically load images in viewed messages" in Preferences so senders' pixels stop firing, then update to 1.26.0 or later so replies don't fetch them either.
3. Skip the Mailspring ID if you don't need its cloud features. Both tracking plugins require it.

What We Could Not Verify

We read Mailspring's public client code and probed its server, but we did not install the app or send tracked mail. The server code isn't public: the PR's backend notes file was added and then deleted in the same merge. So we can't say how long Mailspring keeps open logs, whether it stores the IP address of each pixel request, or how the current free quota is set; Mailspring's GitHub repository doesn't say. The privacy policy's general Log Data clause covers IP addresses for "both Account holders and non-Account holders" without mentioning pixels.